list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libarchiveUpgrade bsdtarUpgrade libarchive-devel | Jul 1, 2025 | Mar 2, 2025 |
| Alpine Linux | — | Upgrade libarchive | Aug 8, 2025 | Mar 2, 2025 |
| Debian | — | No solution exists | May 15, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libarchive | Jul 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libarchive | Jun 13, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libarchive | Jun 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libarchive | Jul 1, 2025 | Mar 2, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade libarchiveUpgrade libarchive-develUpgrade bsdtar | Jun 30, 2025 | Mar 2, 2025 |
| Redhat_linux | — | Upgrade libarchive-develUpgrade bsdtarUpgrade libarchive-debugsourceNo solution existsUpgrade libarchiveUpgrade bsdcat-debuginfoUpgrade bsdcpio-debuginfoUpgrade bsdunzip-debuginfoUpgrade bsdtar-debuginfoUpgrade libarchive-debuginfo | Jun 26, 2025 | Mar 2, 2025 |
| Rocky_linux | — | Upgrade bsdtar-debuginfoUpgrade libarchiveUpgrade libarchive-debugsourceUpgrade libarchive-debuginfoUpgrade libarchive-develUpgrade bsdtar | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade libarchive-develUpgrade libarchive13-32bitUpgrade libarchive13Upgrade bsdtar | Dec 5, 2025 | Jun 26, 2025 |
| Ubuntu | — | Upgrade bsdcpio (Ubuntu Pro)Upgrade libarchive13 (Ubuntu Pro)Upgrade libarchive-dev (Ubuntu Pro)Upgrade libarchive-devUpgrade libarchive13t64Upgrade bsdtar (Ubuntu Pro)Upgrade libarchive13Upgrade libarchive-tools (Ubuntu Pro)Upgrade libarchive-tools | Apr 24, 2025 | Mar 2, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub